Global Legal Monitor

Russia: New Electronic Surveillance Rules

(July 18, 2016) On July 6, 2016, the President of the Russian Federation signed the recently adopted Federal Law No. 374 on Amending the Federal Law on Counterterrorism and Select Legislative Acts of the Russian Federation Concerning the Creation of Additional Measures Aimed at Countering Terrorism and Protecting Public Safety (Federal Law No. 374, PRAVO.GOV.RU (July 7, 2014) (official publication, in Russian). The Law contains a number of provisions expanding the rights of the intelligence and secret services in monitoring private electronic communications and creates legal grounds for law enforcement agencies to intercept “individual computer information.” (Id. art. 3.)

The Law contains new requirements for operators of telecommunications networks on the identification of users and the preservation of metadata transmitted through the networks. The Law adds to the Federal Law on Communications and the Law on Information and Information Technology a requirement for all network operators to “keep metadata about all connections, transmissions, and receipts of voice information, written texts, images, sounds, video, and other messages transferred through communications networks” for a period of three years. (Id. art. 13 § 2.) The same metadata for messages transmitted online must be preserved by Internet providers or organizations hosting message exchange services for one year. (Id. art. 15 § 1.) These provisions will take effect on July 20, 2016. (Id. art. 19.)

The exact text of transmitted messages, records of telephone communications (“voice information”), and content of other communications must be preserved by telecommunications network operators for a period of six months. Under a provision effective on July 1, 2018, this information must be forwarded to the security services upon their request. (Id.)

New requirements are established for the encryption equipment used by Internet providers. Certification requirements for cipher keys and encryption equipment were established by earlier legislation. Law 374 amends the Code of Administrative Violations to establish fines for additional encryption or for using previously uncertified encryption equipment of up to RUB40,000 (about US$700) and to authorize the confiscation of encoding equipment. (Id. art. 11, § 3.)

Also, the Law imposes on distributors of information via the Internet the obligation to report to the Federal Security Service “all information required for the description of received, transferred, or delivered electronic communications.” The refusal to provide such information will be punishable by a fine in the amount of RUB1 million rubles (about US$16,000). (Id. art. 11 §§ 5–6.)

Commentators say that it is not clear from the language of the Law whether the encryption amendments are referring to encryption software used by electronic messengers or by any site with encrypting HTTPS protocol. (On Friday, Duma Will Pass Two of Its Toughest Laws, MEDUZA.IO (June 22, 2016) (in Russian).)

According to the Russian national news agency TASS, simultaneously with signing this Law, the President of Russia issued a number of assignments to the Cabinet of Ministers and some government agencies, ordering them to draft, by November 1, 2016, legal acts aimed at lowering the risks associated with the implementation of the Law. The assignments provide for the development of technical requirements for the domestic software and hardware that will be needed to collect, preserve, and retrieve all information transferred through the Russian segment of the Internet and information about Russian Internet users. The Federal Security Service is assigned the task of defining encryption certification procedures and the protocol for encryption key transfers, together with the responsibility to create the list of equipment subject to certification. As the Federal Minister of Communications stated, the work on these assignments will allow for the development of implementation procedures for the newly adopted legislation and the preparation of necessary amendments that can be passed later. (Putin Signed the Yarovoy Package, TASS (July 7, 2016) (in Russian).)